One card per question you missed, the ones you were sure about first. Cover the answer, say it out loud, then check. Look at each card again on the days listed: 1, 3, 7 and 21 days from Oct 25. If you miss it again, start that card over.
Network Securitymarked sure
A municipal utility still manages several pump controllers through a terminal program that connects on TCP port 23. A new sysadmin, Devon, captures traffic during a routine login and can read the operator's password in plain text. He proposes a replacement. Which change removes the exposure while keeping command-line administration?
Answer: A. Replace Telnet with SSH on TCP port 22 so the session is encrypted and the server is authenticated
Telnet sends credentials and every keystroke in clear text, so anyone positioned on the path can read them. SSH (RFC 4253) negotiates an encrypted transport and authenticates the server with a host key, which is why the exam pairs Telnet with SSH as the insecure/secure equivalents, alongside HTTP/HTTPS and FTP/SFTP.
Source: RFC 4253, The Secure Shell (SSH) Transport Layer Protocol
Business Continuity, Disaster Recovery, and Incident Responsemarked sure
A fire destroys a manufacturing plant's on-site server room. Within hours, the plant runs orders from paper forms and a phone tree, while the IT team restores the ERP system at a secondary data center over the next two days. The plant manager asks a new analyst to explain which plan did what. Which description is correct?
Answer: A. The business continuity plan kept operations running on paper; the disaster recovery plan restored the ERP system
Business continuity focuses on sustaining critical business functions during and after a disruption, by any workable means, such as paper forms and phone trees. Disaster recovery is the IT-focused subset that restores systems and data, such as bringing the ERP back at a secondary site. Option B swaps the two.
Source: NIST SP 800-34 Rev. 1, Section 2.2 Types of Plans
Security Operationsmarked sure
A new analyst is configuring system hardening on a database server. Which combination of steps best matches the ISC2 CC hardening framework?
Answer: A. Disable unused services, change default credentials, apply current patches, restrict administrative access, enable logging
System hardening means reducing the attack surface of a system to what the workload needs. NIST SP 800-123 describes the steps in option A: remove or disable unneeded services and accounts, replace vendor defaults, keep the operating system and database software patched, limit who holds administrative rights, and turn…
Source: NIST SP 800-123 Guide to General Server Security
Security Principlesmarked sure
A SaaS startup encrypts customer data at rest and restricts access to two engineers. Its marketing team then starts selling customer email addresses to advertisers, a use never mentioned when customers signed up. A compliance officer objects. Which concept did the marketing practice violate, even though the data was never breached?
Answer: C. Privacy, because personal data was used for a purpose the individuals did not agree to
Privacy is the right of individuals to control how their personal information is collected, used, and shared. Confidentiality controls (encryption, restricted access) can be fully intact while privacy is still violated, because the organization itself used the data for an undisclosed purpose.
Source: NIST IR 7298 Rev. 3, Glossary of Key Information Security Terms
Network Security
Marta, a help desk technician at a logistics firm, reviews a firewall report that shows an inbound rule permitting TCP port 3389 from any internet address to a warehouse workstation. She has to explain to her manager what service this rule exposes. Which service listens on that port?
Answer: C. Remote Desktop Protocol sessions
TCP port 3389 is the well-known port for Remote Desktop Protocol. An inbound rule from any address means anyone on the internet can attempt a graphical login to that workstation, which is a favorite entry point for brute-force and credential-reuse attacks (MITRE ATT&CK T1021.001).
Source: MITRE ATT&CK T1021.001, Remote Services: Remote Desktop Protocol
Network Security
The public booking site of a regional airline becomes unreachable at 09:10. The network team sees inbound traffic at 40 times the normal rate arriving from tens of thousands of distinct source addresses across many countries. No login attempts or data access appear in the logs. What kind of attack is this, and what is its goal?
Answer: D. A distributed denial-of-service attack that exhausts bandwidth or server capacity to deny users availability
Traffic from tens of thousands of sources at once, with no attempt to authenticate or read data, is the signature of a distributed denial of service (MITRE ATT&CK T1498, Network Denial of Service).
Source: MITRE ATT&CK T1498, Network Denial of Service
Network Security
A network admin must allow web traffic from the internet to a public application but block direct internet access to internal application servers. Which architecture best fits?
Answer: B. Internet-facing DMZ (or perimeter network) for the public application, separate private subnets for internal application servers, firewall between
A DMZ (also called a perimeter network) is the canonical pattern for hosting publicly-reachable services while keeping internal application servers in a private subnet. Firewalls between zones enforce the boundary.
Source: NIST SP 800-41 Rev. 1
Business Continuity, Disaster Recovery, and Incident Response
A help-desk technician at a law firm sees a ransom note appear on a paralegal's laptop and watches files on a mapped share start changing to a strange extension. He has the incident-response plan open. What should be his first action?
Answer: B. Disconnect the laptop from the network and notify the incident response team
Once an incident is detected, the priority is containment: stop the damage from spreading while preserving what responders need. Pulling the laptop off the network halts encryption of the shared drive and other hosts, and notifying the team starts the coordinated response.
Source: NIST SP 800-61 Rev. 3, Section 3 Respond Function
Business Continuity, Disaster Recovery, and Incident Response
A school district is starting its first business continuity plan. The superintendent wants to jump straight to buying backup generators. The IT director says the district first needs to know which functions matter most and how long each can be down. Which activity produces that information?
Answer: C. A business impact analysis (BIA)
The business impact analysis identifies critical business functions, the systems that support them, and the consequences of losing them over time. Its outputs, such as maximum tolerable downtime and recovery priorities, tell the district what to protect first and justify spending like generators.
Source: NIST SP 800-34 Rev. 1, Section 3.2 Conduct the Business Impact Analysis
Security Operations
A game studio is drafting its first bring-your-own-device policy. Staff want to read work email on personal phones. The CISO wants to be able to remove studio data from a phone when someone leaves, without touching the person's photos. Which policy element delivers that?
Answer: A. Enroll personal devices in mobile device management with work data kept in a managed container that can be selectively wiped
NIST SP 800-124 Rev. 2 describes the BYOD deployment model and the controls that make it workable: enterprise mobility management with a separation of work and personal data, so the organisation can enforce settings on the work portion and perform a selective wipe when the person leaves. Option A is that control.
Source: NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise
Review on: Oct 26, Oct 28, Nov 1, Nov 15.